CVE-2026-35285 is a critical security vulnerability in the Oracle WebCenter Enterprise Capture product, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an attacker with low privileges and network access via T3 or IIOP protocols to compromise the product, potentially resulting in full takeover. The vulnerability also has scope change implications, meaning exploitation could significantly impact other Oracle products. The CVSS 3.1 score of 9.9 reflects critical impact across confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its June 2026 Critical Security Patch Update. The vendor advisory emphasizes the importance of applying patches without delay and suggests temporary mitigations such as blocking attack-related network protocols and limiting user privileges, though these may disrupt normal operations.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle WebCenter Enterprise Capture, including full takeover of the system. The vulnerability affects confidentiality, integrity, and availability, potentially allowing attackers to access sensitive data, alter or destroy data, and disrupt service. Additionally, the vulnerability's scope change means that other Oracle products integrated or related to WebCenter Enterprise Capture may also be impacted.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the security patches as soon as possible to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation (such as T3 and IIOP) and by removing unnecessary privileges or access to vulnerable packages from users who do not require them. However, these mitigations may impact application functionality. Oracle recommends remaining on actively supported versions and applying patches without delay.